CISA has taken on more responsibilities for the defense of federal agency networks. A new report considers how much farther that should go.